diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index ff15338ead..2de12a9cee 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,3 +1,8 @@
+paths: # https://github.com/rhysd/actionlint/issues/711
+  .github/*/*.yml:
+    ignore:
+      - 'reusable workflow call "\$/\.github/workflows/[a-z0-9-]+\.yml" at "uses" is not following the format'
+      - 'specifying action "\$/\.github/actions/[a-z0-9-]+" in invalid format'
 self-hosted-runner:
   labels:
     - aarch64-darwin
diff --git a/.github/actions/install-nix/action.yml b/.github/actions/install-nix/action.yml
index ba987904d2..1038302f2c 100644
--- a/.github/actions/install-nix/action.yml
+++ b/.github/actions/install-nix/action.yml
@@ -35,7 +35,7 @@ runs:
         ROLE_TO_ASSUME: ${{ inputs.role-to-assume }}
 
     - name: configure aws credentials
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      uses: aws-actions/configure-aws-credentials@v6.3.0
       if: steps.resolve-push-to-cache.outputs.value == 'true'
       with:
         role-to-assume: ${{ inputs.role-to-assume }}
diff --git a/.github/actions/shared-checkout/action.yml b/.github/actions/shared-checkout/action.yml
deleted file mode 100644
index a490dd26d2..0000000000
--- a/.github/actions/shared-checkout/action.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Checkout
-description: Checkout repository for pull requests and branches
-runs:
-  using: "composite"
-  steps:
-    - name: Checkout repository
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      with:
-        repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-        ref: ${{ github.event.pull_request.head.sha || github.sha }}
-        fetch-depth: 0
-        fetch-tags: true
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000000..b3864ae79e
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,250 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ami-release-nix.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'rtcamp/action-slack-notify@v2.4.0'
+        - 'softprops/action-gh-release@v3.0.3'
+    '.github/workflows/check-extension-versions.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'peter-evans/create-pull-request@v8.1.1'
+    '.github/workflows/cleanup-stale-ec2.yml':
+        - 'actions/checkout@v6.0.1'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'slackapi/slack-github-action@v4.0.0'
+    '.github/workflows/cli-release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'softprops/action-gh-release@v3.0.3'
+    '.github/workflows/cli-smoke-test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+    '.github/workflows/docker-image-test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+    '.github/workflows/dockerhub-release-matrix.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/build-push-action@v7.4.0'
+        - 'docker/login-action@v4.6.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+    '.github/workflows/manual-docker-release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/build-push-action@v7.4.0'
+        - 'docker/login-action@v4.6.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+    '.github/workflows/mirror-postgrest.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'mikefarah/yq@v4.54.1'
+    '.github/workflows/mirror.yml':
+        - 'akhilerm/tag-push-action@v2.3.0'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/login-action@v4.6.0'
+    '.github/workflows/nix-build.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'peter-evans/create-or-update-comment@v5.0.0'
+        - 'peter-evans/find-comment@v4.0.0'
+    '.github/workflows/nix-dependency-analysis.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'peter-evans/create-or-update-comment@v5.0.0'
+        - 'peter-evans/find-comment@v4.0.0'
+    '.github/workflows/publish-migrations-prod.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+    '.github/workflows/publish-migrations-staging.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+    '.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'rtcamp/action-slack-notify@v2.4.0'
+    '.github/workflows/publish-nix-pgupgrade-scripts.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'rtcamp/action-slack-notify@v2.4.0'
+    '.github/workflows/qemu-image-build.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/amazon-ecr-login@v2.1.7'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'rtcamp/action-slack-notify@v2.4.0'
+    '.github/workflows/test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+    '.github/workflows/testinfra-ami-build.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+    '.github/workflows/update-flake-lock-non-critical.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'peter-evans/create-pull-request@v8.1.1'
+    '.github/workflows/update-flake-lock.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/create-github-app-token@v3.3.0'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'determinatesystems/update-flake-lock@v29'
+dependencies:
+    'actions/checkout@v6.0.1':
+        ref: 'v6.0.1'
+        commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/create-github-app-token@v3.3.0':
+        ref: 'v3.3.0'
+        commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/download-artifact@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'akhilerm/tag-push-action@v2.3.0':
+        ref: 'v2.3.0'
+        commit: 'sha1-eadeefebd39db8a47e146115649adae1fce576a6'
+        owner_id: 7610845
+        repo_id: 314832723
+    'aws-actions/amazon-ecr-login@v2.1.7':
+        ref: 'v2.1.7'
+        commit: 'sha1-03f1aad4c6c7ffd436567f42f9384779290529bd'
+        owner_id: 57468012
+        repo_id: 220389860
+    'aws-actions/configure-aws-credentials@v6.3.0':
+        ref: 'v6.3.0'
+        commit: 'sha1-e1253824e5c10ff9df46874f81ed3ec929e19cfd'
+        owner_id: 57468012
+        repo_id: 220391287
+    'crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd':
+        ref: 'v7.0.0'
+        commit: 'sha1-2dc316deee8e90f13e1a351ab510b4d5bc0c82cd'
+        owner_id: 1951866
+        repo_id: 260488959
+    'damianreeves/write-file-action@6929a9a6d1807689191dcc8bbe62b54d70a32b42':
+        ref: 'v1.3'
+        commit: 'sha1-6929a9a6d1807689191dcc8bbe62b54d70a32b42'
+        owner_id: 957246
+        repo_id: 258052107
+    'determinatesystems/update-flake-lock@v29':
+        ref: 'v29'
+        commit: 'sha1-da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3'
+        owner_id: 80991770
+        repo_id: 418625766
+        uses:
+            - 'crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd'
+            - 'damianreeves/write-file-action@6929a9a6d1807689191dcc8bbe62b54d70a32b42'
+            - 'juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18'
+            - 'pedrolamas/handlebars-action@2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4'
+            - 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1'
+    'docker/build-push-action@v7.4.0':
+        ref: 'v7.4.0'
+        commit: 'sha1-c3c9e263c25d99ce0380d002d59b67737d91b0dc'
+        owner_id: 5429470
+        repo_id: 241092383
+    'docker/login-action@v4.6.0':
+        ref: 'v4.6.0'
+        commit: 'sha1-dbcb813823bdd20940b903addbd779551569679f'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/setup-buildx-action@v4.4.1':
+        ref: 'v4.4.1'
+        commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069'
+        owner_id: 5429470
+        repo_id: 288485773
+    'juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18':
+        ref: 'v1.1.8'
+        commit: 'sha1-271ff311a4947af354c6abcd696a306553b9ec18'
+        owner_id: 10247
+        repo_id: 244608449
+    'lovetoknow/slackify-markdown-action@698a1d4d0ff1794152a93c03ee8ca5e03a310d4e':
+        ref: 'v1.1.1'
+        commit: 'sha1-698a1d4d0ff1794152a93c03ee8ca5e03a310d4e'
+        owner_id: 168084
+        repo_id: 271813698
+    'mikefarah/yq@v4.54.1':
+        ref: 'v4.54.1'
+        commit: 'sha1-504fc38780cc46be8444ea1b72fb55919fc0bfb0'
+        owner_id: 1151925
+        repo_id: 43225113
+    'pedrolamas/handlebars-action@2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4':
+        ref: 'v2.4.0'
+        commit: 'sha1-2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4'
+        owner_id: 85504
+        repo_id: 304154389
+    'peter-evans/create-or-update-comment@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-e8674b075228eee787fea43ef493e45ece1004c9'
+        owner_id: 18365890
+        repo_id: 223708643
+    'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1':
+        ref: 'v8.1.1'
+        commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1'
+        owner_id: 18365890
+        repo_id: 197176365
+    'peter-evans/create-pull-request@v8.1.1':
+        ref: 'v8.1.1'
+        commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1'
+        owner_id: 18365890
+        repo_id: 197176365
+    'peter-evans/find-comment@v4.0.0':
+        ref: 'v4.0.0'
+        commit: 'sha1-b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad'
+        owner_id: 18365890
+        repo_id: 256447541
+    'rtcamp/action-slack-notify@v2.4.0':
+        ref: 'v2.4.0'
+        commit: 'sha1-33ca3be66c6f378fe1610fd1d5258632dbed5e58'
+        owner_id: 1128395
+        repo_id: 173934970
+        uses:
+            - 'lovetoknow/slackify-markdown-action@698a1d4d0ff1794152a93c03ee8ca5e03a310d4e'
+    'slackapi/slack-github-action@v4.0.0':
+        ref: 'v4.0.0'
+        commit: 'sha1-dcb1066f776dd043e64d0e8ba94ca15cc7e1875d'
+        owner_id: 6962987
+        repo_id: 306439799
+    'softprops/action-gh-release@v3.0.3':
+        ref: 'v3.0.3'
+        commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
+        owner_id: 2242
+        repo_id: 204253808
diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml
index 9b90e92290..42932395f6 100644
--- a/.github/workflows/ami-release-nix.yml
+++ b/.github/workflows/ami-release-nix.yml
@@ -28,10 +28,10 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Set PostgreSQL versions
         id: set-versions
@@ -59,7 +59,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Debug AWS role secret
         run: |
@@ -71,7 +71,7 @@ jobs:
           fi
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -79,7 +79,7 @@ jobs:
           role-duration-seconds: 7200
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           aws-region: ${{ env.AWS_REGION }}
@@ -88,13 +88,13 @@ jobs:
 
       - name: Resolve git sha
         id: resolve-git-sha
-        uses: ./.github/actions/resolve-git-sha
+        uses: $/.github/actions/resolve-git-sha
         with:
           flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }}
 
       - name: Build AMI
         id: build-ami
-        uses: ./.github/actions/build-ami
+        uses: $/.github/actions/build-ami
         with:
           ami_name_prefix: ${{ matrix.target.ami_name_prefix }}
           ami_regions: '["${{ env.AWS_REGION }}"]'
@@ -136,7 +136,7 @@ jobs:
           tar -czf "/tmp/pg_binaries.tar.gz" -C "/tmp/pg_upgrade_bin" .
 
       - name: configure aws credentials - staging
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -148,7 +148,7 @@ jobs:
           aws s3 cp /tmp/pg_binaries.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades$ARCH_SUFFIX/postgres/supabase-postgres-$POSTGRES_SUPABASE_VERSION/upgrade_bundle.tar.gz"
 
       - name: configure aws credentials - prod
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -160,14 +160,14 @@ jobs:
           aws s3 cp /tmp/pg_binaries.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades$ARCH_SUFFIX/postgres/supabase-postgres-$POSTGRES_SUPABASE_VERSION/upgrade_bundle.tar.gz"
 
       - name: GitHub OIDC Auth
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           aws-region: us-east-1
           role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role
           role-session-name: shared-services-jump
 
       - name: Assume destination role
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           aws-region: us-east-1
           role-to-assume: arn:aws:iam::279559813984:role/supabase-nix-catalog-artifacts-role-6387512
@@ -204,7 +204,7 @@ jobs:
           echo "Catalog uploaded to ${CATALOG_S3}"
 
       - name: Create release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        uses: softprops/action-gh-release@v3.0.3
         with:
           name: ${{ env.RELEASE_TAG }}
           tag_name: ${{ env.RELEASE_TAG }}
@@ -245,7 +245,7 @@ jobs:
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
-        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        uses: rtCamp/action-slack-notify@v2.4.0
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
           SLACK_USERNAME: 'gha-failures-notifier'
@@ -255,7 +255,7 @@ jobs:
 
       - name: Configure AWS credentials for cleanup
         if: always()
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
diff --git a/.github/workflows/check-extension-versions.yml b/.github/workflows/check-extension-versions.yml
index f74e2a3c67..a58f09e9fe 100644
--- a/.github/workflows/check-extension-versions.yml
+++ b/.github/workflows/check-extension-versions.yml
@@ -13,10 +13,10 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Install Nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Check for new extension versions
         env:
@@ -24,7 +24,7 @@ jobs:
         run: nix run .#check-ext-versions
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "chore: update extension versions"
diff --git a/.github/workflows/cleanup-stale-ec2.yml b/.github/workflows/cleanup-stale-ec2.yml
index c24d894da0..c0bcbe5e2e 100644
--- a/.github/workflows/cleanup-stale-ec2.yml
+++ b/.github/workflows/cleanup-stale-ec2.yml
@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ matrix.region }}
@@ -44,7 +44,7 @@ jobs:
 
       - name: Upload summary
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: cleanup-summary-${{ matrix.region }}
           path: ${{ runner.temp }}/summary.txt
@@ -61,13 +61,13 @@ jobs:
 
     steps:
       - name: Checkout scripts
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           sparse-checkout: ci
           persist-credentials: false
 
       - name: Download summaries
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4.3.0
         with:
           pattern: cleanup-summary-*
           path: summaries
@@ -96,7 +96,7 @@ jobs:
           ci/build-slack-payload.sh summaries/*/summary.txt | tee "$RUNNER_TEMP/payload.json"
 
       - name: Slack Notification
-        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        uses: slackapi/slack-github-action@v4.0.0
         with:
           webhook: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
           webhook-type: incoming-webhook
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index 999e311d0b..3c1db3a0e1 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -31,19 +31,19 @@ jobs:
             arch: linux-arm64
     steps:
       - name: Checkout repository
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Install Nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Run portability check
-        uses: ./.github/actions/nix-build-retry
+        uses: $/.github/actions/nix-build-retry
         with:
           attr: .#checks.${{ matrix.system }}.psql_17_cli_portable
           extra-args: --system ${{ matrix.system }}
 
       - name: Build portable CLI bundle
-        uses: ./.github/actions/nix-build-retry
+        uses: $/.github/actions/nix-build-retry
         with:
           attr: .#psql_17_cli_portable
           extra-args: --system ${{ matrix.system }}
@@ -72,7 +72,7 @@ jobs:
           shopt -u dotglob
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: supabase-postgres-${{ matrix.arch }}
           path: supabase-postgres-${{ steps.version.outputs.version }}-${{ matrix.arch }}
@@ -95,7 +95,7 @@ jobs:
             arch: linux-arm64
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v8.0.2
         with:
           name: supabase-postgres-${{ matrix.arch }}
           path: .
@@ -398,7 +398,7 @@ jobs:
       contents: write
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v8.0.2
         with:
           path: artifacts
 
@@ -453,7 +453,7 @@ jobs:
           fi
 
       - name: Create Release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        uses: softprops/action-gh-release@v3.0.3
         with:
           tag_name: ${{ steps.release_tag.outputs.tag }}
           files: release/*
diff --git a/.github/workflows/cli-smoke-test.yml b/.github/workflows/cli-smoke-test.yml
index 1e6eec0aa1..59d0c46f14 100644
--- a/.github/workflows/cli-smoke-test.yml
+++ b/.github/workflows/cli-smoke-test.yml
@@ -23,14 +23,14 @@ jobs:
       base_hash: ${{ steps.check.outputs.base_hash }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Check Docker image changes
         id: check
-        uses: ./.github/actions/check-docker-image-changes
+        uses: $/.github/actions/check-docker-image-changes
         with:
           event_name: ${{ github.event_name }}
           base_ref: ${{ github.base_ref }}
@@ -47,16 +47,16 @@ jobs:
         pg_version: ['15', '17']
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Create Docker context
         run: docker context create builders
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@v4.4.1
         with:
           endpoint: builders
 
diff --git a/.github/workflows/docker-image-test.yml b/.github/workflows/docker-image-test.yml
index 8d907e8859..29b79719b7 100644
--- a/.github/workflows/docker-image-test.yml
+++ b/.github/workflows/docker-image-test.yml
@@ -28,14 +28,14 @@ jobs:
       input_hash: ${{ steps.check.outputs.input_hash }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Check Docker image changes
         id: check
-        uses: ./.github/actions/check-docker-image-changes
+        uses: $/.github/actions/check-docker-image-changes
         with:
           event_name: ${{ github.event_name }}
           base_ref: ${{ github.base_ref }}
@@ -57,16 +57,16 @@ jobs:
           - { dockerfile: Dockerfile-multigres,   target: variant-orioledb-17, name: multigres-orioledb-17   }
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Create Docker context
         run: docker context create builders
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@v4.4.1
         with:
           endpoint: builders
 
diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml
index aa8cea4ebb..bf95dbe9fe 100644
--- a/.github/workflows/dockerhub-release-matrix.yml
+++ b/.github/workflows/dockerhub-release-matrix.yml
@@ -21,8 +21,8 @@ jobs:
       matrix_config: ${{ steps.set-matrix.outputs.matrix_config }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
       - name: Generate build matrix
         id: set-matrix
         run: |
@@ -74,8 +74,8 @@ jobs:
       build_args: ${{ steps.args.outputs.result }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV
       
@@ -99,13 +99,13 @@ jobs:
     timeout-minutes: 180
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
       - run: docker context create builders
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - uses: docker/setup-buildx-action@v4.4.1
         with:
           endpoint: builders
-      - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+      - uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -142,7 +142,7 @@ jobs:
             echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT
           fi
       - id: build
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        uses: docker/build-push-action@v7.4.0
         with:
           push: true
           build-args: |
@@ -161,10 +161,10 @@ jobs:
     runs-on: large-linux-x86
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
+      - uses: docker/setup-buildx-action@v4.4.1
+      - uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -193,7 +193,7 @@ jobs:
         run: |
           echo "${{ steps.output_version.outputs.result }}" >> results.txt  # Append results
       - name: Upload Results Artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: merge_results-${{ matrix.version }}
           path: results.txt
@@ -208,8 +208,8 @@ jobs:
     runs-on: large-linux-x86
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
 
       - name: Debug Input from Prepare
         run: |
@@ -232,7 +232,7 @@ jobs:
             $"versions=$versions_str" | save --append $env.GITHUB_ENV
           '
       - name: Download Results Artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v8.0.2
         with:
           pattern: merge_results-*
       - name: Combine Results
@@ -276,7 +276,7 @@ jobs:
         id-token: write
       strategy:
         matrix: ${{ fromJson(needs.combine_results.outputs.matrix) }}
-      uses: ./.github/workflows/mirror.yml
+      uses: $/.github/workflows/mirror.yml
       with:
         version: ${{ matrix.version }}
       secrets: inherit
diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml
index cd3ac94984..1967dc0c0c 100644
--- a/.github/workflows/manual-docker-release.yml
+++ b/.github/workflows/manual-docker-release.yml
@@ -17,9 +17,9 @@ jobs:
     outputs:
       matrix_config: ${{ steps.set-matrix.outputs.matrix_config }}
     steps:
-      - uses: ./.github/actions/install-nix
+      - uses: $/.github/actions/install-nix
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
       - name: Generate build matrix
         id: set-matrix
         run: |
@@ -71,8 +71,8 @@ jobs:
       build_args: ${{ steps.args.outputs.result }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV
       
@@ -96,13 +96,13 @@ jobs:
     timeout-minutes: 180
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
       - run: docker context create builders
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - uses: docker/setup-buildx-action@v4.4.1
         with:
           endpoint: builders
-      - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+      - uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -149,7 +149,7 @@ jobs:
             echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT
           fi
       - id: build
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        uses: docker/build-push-action@v7.4.0
         with:
           push: true
           build-args: |
@@ -168,10 +168,10 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
+      - uses: docker/setup-buildx-action@v4.4.1
+      - uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -200,7 +200,7 @@ jobs:
         run: |
           echo "${{ steps.output_version.outputs.result }}" >> results.txt  # Append results
       - name: Upload Results Artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: merge_results-${{ matrix.version }}
           path: results.txt
@@ -215,8 +215,8 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
 
       - name: Debug Input from Prepare
         run: |
@@ -239,7 +239,7 @@ jobs:
             $"versions=$versions_str" | save --append $env.GITHUB_ENV
           '
       - name: Download Results Artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v8.0.2
         with:
           pattern: merge_results-*
       - name: Combine Results
@@ -283,7 +283,7 @@ jobs:
       needs: combine_results
       strategy:
         matrix: ${{ fromJson(needs.combine_results.outputs.matrix) }}
-      uses: ./.github/workflows/mirror.yml
+      uses: $/.github/workflows/mirror.yml
       with:
         version: ${{ inputs.postgresVersion != '' && (contains(matrix.version, '-multigres') && format('{0}-multigres', inputs.postgresVersion) || inputs.postgresVersion) || matrix.version }}
       secrets: inherit
diff --git a/.github/workflows/mirror-postgrest.yml b/.github/workflows/mirror-postgrest.yml
index 6d2d03532e..215e409007 100644
--- a/.github/workflows/mirror-postgrest.yml
+++ b/.github/workflows/mirror-postgrest.yml
@@ -18,9 +18,9 @@ jobs:
       postgrest_release: ${{ steps.args.outputs.result }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
       - id: args
-        uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8 # v4.50.1
+        uses: mikefarah/yq@v4.54.1
         with:
           cmd: yq '.postgrest_release' 'ansible/vars.yml'
 
@@ -31,7 +31,7 @@ jobs:
       contents: read
       packages: write
       id-token: write
-    uses: supabase/cli/.github/workflows/mirror-image.yml@main
+    uses: supabase/cli/.github/workflows/mirror-image.yml@e9da2363fa52ccfb1cfb49611cabd8e49cb21577 # v3.0.0-next.16
     with:
       image: postgrest/postgrest:v${{ needs.version.outputs.postgrest_release }}
     secrets: inherit
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index e7ca8b2371..028f18c4bc 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -25,19 +25,19 @@ jobs:
       id-token: write
     steps:
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: us-east-1
-      - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+      - uses: docker/login-action@v4.6.0
         with:
           registry: public.ecr.aws
-      - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+      - uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: akhilerm/tag-push-action@85bf542f43f5f2060ef76262a67ee3607cb6db37 # v2.1.0
+      - uses: akhilerm/tag-push-action@v2.3.0
         with:
           src: docker.io/supabase/postgres:${{ inputs.version }}
           dst: |
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index fa15ad8865..c71b9605a3 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -26,10 +26,10 @@ jobs:
       checks_matrix: ${{ steps.gen-matrix.outputs.checks_matrix }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
@@ -48,7 +48,7 @@ jobs:
 
       - name: Upload drvPaths artifact
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: head-drvpaths
           path: /tmp/drvpaths/*.json
@@ -74,17 +74,17 @@ jobs:
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
       - name: Install nix
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
       - name: nix build
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/nix-build-retry
+        uses: $/.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
 
@@ -102,17 +102,17 @@ jobs:
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
       - name: Install nix
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
       - name: nix build
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/nix-build-retry
+        uses: $/.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
 
@@ -128,17 +128,17 @@ jobs:
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
       - name: Install nix
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
       - name: nix build
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/nix-build-retry
+        uses: $/.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
 
@@ -156,17 +156,17 @@ jobs:
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
       - name: Install nix
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
       - name: nix build
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/nix-build-retry
+        uses: $/.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
 
@@ -182,17 +182,17 @@ jobs:
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
       - name: Install nix
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
       - name: nix build
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/nix-build-retry
+        uses: $/.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
 
@@ -210,17 +210,17 @@ jobs:
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
       - name: Install nix
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
       - name: nix build
         if: ${{ matrix.attr != '' }}
-        uses: ./.github/actions/nix-build-retry
+        uses: $/.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
 
@@ -246,7 +246,7 @@ jobs:
     needs:
       - builds-aarch64-linux
       - builds-x86_64-linux
-    uses: ./.github/workflows/testinfra-ami-build.yml
+    uses: $/.github/workflows/testinfra-ami-build.yml
     secrets:
       DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
       NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
@@ -255,11 +255,11 @@ jobs:
     needs:
       - builds-aarch64-linux
       - builds-x86_64-linux
-    uses: ./.github/workflows/test.yml
+    uses: $/.github/workflows/test.yml
 
   containers:
     needs: builds-aarch64-linux
-    uses: ./.github/workflows/docker-image-test.yml
+    uses: $/.github/workflows/docker-image-test.yml
     secrets:
       DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
       NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
@@ -298,22 +298,22 @@ jobs:
     runs-on: ${{ matrix.runs_on }}
     steps:
       - name: Checkout PR head
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
         with:
           path: head
 
       - name: Checkout PR base
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: base
 
       - name: Install nix
-        uses: ./head/.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       # HEAD side already done in eval
       - name: Download head drvPaths
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.2
         with:
           name: head-drvpaths
           path: /tmp/head-drvpaths
@@ -330,7 +330,7 @@ jobs:
         run: ./head/ci/version-diff/diff.sh "${{ matrix.system }}"
 
       - name: Upload diff artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: diff-${{ matrix.system }}
           path: /tmp/diff.txt
@@ -345,10 +345,10 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Download diff artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.2
         with:
           pattern: diff-*
           path: diffs
@@ -358,7 +358,7 @@ jobs:
         run: ./ci/version-diff/comment.sh
 
       - name: Find existing version diff comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@v4.0.0
         id: fc
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -366,7 +366,7 @@ jobs:
           body-includes: "<!-- version-diff -->"
 
       - name: Comment on PR
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5.0.0
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/nix-dependency-analysis.yml b/.github/workflows/nix-dependency-analysis.yml
index d4b4fd8990..d6682a0393 100644
--- a/.github/workflows/nix-dependency-analysis.yml
+++ b/.github/workflows/nix-dependency-analysis.yml
@@ -30,10 +30,10 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404-arm
     steps:
       - name: Checkout repository
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Install Nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: "false"
         env:
@@ -60,7 +60,7 @@ jobs:
           fi
 
       - name: Find existing dependency comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@v4.0.0
         id: fc-dep
         if: github.event_name == 'pull_request'
         with:
@@ -69,7 +69,7 @@ jobs:
           body-includes: "<!-- dependency-diff-analysis -->"
 
       - name: Create or update dependency comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5.0.0
         if: github.event_name == 'pull_request'
         with:
           comment-id: ${{ steps.fc-dep.outputs.comment-id }}
@@ -82,10 +82,10 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout repository
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Install Nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: "false"
         env:
@@ -112,7 +112,7 @@ jobs:
           fi
 
       - name: Find existing extension comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@v4.0.0
         id: fc-ext
         if: github.event_name == 'pull_request'
         with:
@@ -121,7 +121,7 @@ jobs:
           body-includes: "<!-- extension-diff-analysis -->"
 
       - name: Create or update extension comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5.0.0
         if: github.event_name == 'pull_request'
         with:
           comment-id: ${{ steps.fc-ext.outputs.comment-id }}
diff --git a/.github/workflows/publish-migrations-prod.yml b/.github/workflows/publish-migrations-prod.yml
index aec370d7fd..7801b9e120 100644
--- a/.github/workflows/publish-migrations-prod.yml
+++ b/.github/workflows/publish-migrations-prod.yml
@@ -22,14 +22,14 @@ jobs:
           GITHUB_REF: ${{ github.ref }}
 
       - name: Checkout repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Merging migration files
         run: cat $(ls -1) > ../migration-output.sql
         working-directory: ${{ github.workspace }}/migrations/db/migrations
 
       - name: configure aws credentials - prod
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: "us-east-1"
diff --git a/.github/workflows/publish-migrations-staging.yml b/.github/workflows/publish-migrations-staging.yml
index 8162bddac8..c5d0389701 100644
--- a/.github/workflows/publish-migrations-staging.yml
+++ b/.github/workflows/publish-migrations-staging.yml
@@ -16,13 +16,13 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
       - name: Merging migration files
         run: cat $(ls -1) > ../migration-output.sql
         working-directory: ${{ github.workspace }}/migrations/db/migrations
 
       - name: configure aws credentials - staging
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: "us-east-1"
diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
index 1433ffdacd..40a894fc21 100644
--- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
+++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
@@ -17,9 +17,12 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
+        with:
+          fetch-depth: 0
+          fetch-tags: true
 
-      - uses: ./.github/actions/install-nix
+      - uses: $/.github/actions/install-nix
 
       - name: Set PostgreSQL versions
         id: set-versions
@@ -47,9 +50,9 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
-      - uses: ./.github/actions/install-nix
+      - uses: $/.github/actions/install-nix
 
       - name: Grab release version
         id: process_release_version
@@ -73,7 +76,7 @@ jobs:
           tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}"
 
       - name: configure aws credentials - staging
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: "us-east-1"
@@ -88,7 +91,7 @@ jobs:
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
-        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        uses: rtCamp/action-slack-notify@v2.4.0
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
           SLACK_USERNAME: 'gha-failures-notifier'
@@ -106,7 +109,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Grab release version
         id: process_release_version
@@ -130,7 +133,7 @@ jobs:
           tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}"
 
       - name: configure aws credentials - prod
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: "us-east-1"
@@ -145,7 +148,7 @@ jobs:
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
-        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        uses: rtCamp/action-slack-notify@v2.4.0
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
           SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml
index ce08383a97..8754f07ae7 100644
--- a/.github/workflows/publish-nix-pgupgrade-scripts.yml
+++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml
@@ -25,8 +25,11 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: $/.github/actions/install-nix
       - name: Set PostgreSQL versions
         id: set-versions
         env:
@@ -53,9 +56,9 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
-      - uses: ./.github/actions/install-nix
+      - uses: $/.github/actions/install-nix
 
       - name: Grab release version
         id: process_release_version
@@ -77,7 +80,7 @@ jobs:
           tar -czvf /tmp/pg_upgrade_scripts.tar.gz -C /tmp/ pg_upgrade_scripts
 
       - name: configure aws credentials - staging
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: "us-east-1"
@@ -89,7 +92,7 @@ jobs:
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
-        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        uses: rtCamp/action-slack-notify@v2.4.0
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
           SLACK_USERNAME: 'gha-failures-notifier'
@@ -108,9 +111,9 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
-      - uses: ./.github/actions/install-nix
+      - uses: $/.github/actions/install-nix
 
       - name: Grab release version
         id: process_release_version
@@ -132,7 +135,7 @@ jobs:
           tar -czvf /tmp/pg_upgrade_scripts.tar.gz -C /tmp/ pg_upgrade_scripts
 
       - name: configure aws credentials - prod
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: "us-east-1"
@@ -144,7 +147,7 @@ jobs:
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
-        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        uses: rtCamp/action-slack-notify@v2.4.0
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
           SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index b580dd8653..d59e81140b 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -30,7 +30,7 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Set PostgreSQL versions - only builds pg17 atm
         id: set-versions
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: enable KVM support
         run: |
@@ -67,7 +67,7 @@ jobs:
           echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV
 
       - name: Install Nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Run checks if triggered manually
         if: ${{ github.event_name == 'workflow_dispatch' && matrix.arch == 'arm64' }}
@@ -94,7 +94,7 @@ jobs:
 
       - name: Resolve git sha
         id: resolve-git-sha
-        uses: ./.github/actions/resolve-git-sha
+        uses: $/.github/actions/resolve-git-sha
         with:
           flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }}
 
@@ -114,7 +114,7 @@ jobs:
 
       - name: configure aws credentials - staging
         if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/') }}
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.CONTROL_PLANE_DEV_ROLE }}
           aws-region: "us-east-1"
@@ -122,7 +122,7 @@ jobs:
       - name: Login to Amazon ECR Staging
         if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/') }}
         id: login-ecr-private-dev
-        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
+        uses: aws-actions/amazon-ecr-login@v2.1.7
 
       - name: Build image
         env:
@@ -143,7 +143,7 @@ jobs:
       # TODO (darora): temporarily also push to prod account from here - add a guard to only publish proper tagged releases to prod?
       - name: configure aws credentials - prod
         if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }}
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.CONTROL_PLANE_PROD_ROLE }}
           aws-region: "us-east-1"
@@ -151,7 +151,7 @@ jobs:
       - name: Login to Amazon ECR Prod
         if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }}
         id: login-ecr-private-prod
-        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
+        uses: aws-actions/amazon-ecr-login@v2.1.7
 
       - name: Push docker image to Amazon ECR Prod
         if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }}
@@ -165,7 +165,7 @@ jobs:
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
-        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        uses: rtCamp/action-slack-notify@v2.4.0
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
           SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 095522ceb3..87ea2f4d36 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,8 +14,8 @@ jobs:
       postgres_major_versions: ${{ steps.set-versions.outputs.postgres_major_versions }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - uses: ./.github/actions/install-nix
+        uses: actions/checkout@v7.0.1
+      - uses: $/.github/actions/install-nix
       - name: Set PostgreSQL versions
         id: set-versions
         run: |
@@ -33,13 +33,13 @@ jobs:
       POSTGRES_PASSWORD: password
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
-      - uses: ./.github/actions/install-nix
+      - uses: $/.github/actions/install-nix
 
       - name: Resolve git sha
         id: resolve-git-sha
-        uses: ./.github/actions/resolve-git-sha
+        uses: $/.github/actions/resolve-git-sha
         with:
           flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }}
 
diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml
index 7caf30b165..3a117756de 100644
--- a/.github/workflows/testinfra-ami-build.yml
+++ b/.github/workflows/testinfra-ami-build.yml
@@ -25,10 +25,10 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Set PostgreSQL versions
         id: set-versions
@@ -54,7 +54,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Debug AWS role secret
         run: |
@@ -66,7 +66,7 @@ jobs:
           fi
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -74,7 +74,7 @@ jobs:
           role-duration-seconds: 7200
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           aws-region: ${{ env.AWS_REGION }}
@@ -83,13 +83,13 @@ jobs:
 
       - name: Resolve git sha
         id: resolve-git-sha
-        uses: ./.github/actions/resolve-git-sha
+        uses: $/.github/actions/resolve-git-sha
         with:
           flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }}
 
       - name: Build AMI
         id: build-ami
-        uses: ./.github/actions/build-ami
+        uses: $/.github/actions/build-ami
         with:
           ami_name_prefix: "supabase-postgres-${{ github.run_id }}-${{ matrix.target.arch }}"
           ami_regions: '["${{ env.AWS_REGION }}"]'
@@ -114,7 +114,7 @@ jobs:
           >"ami-disk-usage-$POSTGRES_VERSION-$ARCH.json"
 
       - name: Upload AMI disk usage
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: ami-disk-usage-${{ matrix.postgres_version }}-${{ matrix.target.arch }}
           path: ami-disk-usage-*.json
@@ -133,7 +133,7 @@ jobs:
 
       - name: Configure AWS credentials for cleanup
         if: always()
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -149,7 +149,7 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Download AMI disk usage
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v8.0.2
         with:
           pattern: ami-disk-usage-*
           path: ami-disk-usage
diff --git a/.github/workflows/update-flake-lock-non-critical.yml b/.github/workflows/update-flake-lock-non-critical.yml
index 7f8c79a190..bc0829e8f7 100644
--- a/.github/workflows/update-flake-lock-non-critical.yml
+++ b/.github/workflows/update-flake-lock-non-critical.yml
@@ -13,10 +13,10 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Install Nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Update non-critical flake inputs
         run: |
@@ -31,7 +31,7 @@ jobs:
             treefmt-nix
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "chore: update flake.lock non-critical inputs (bimonthly)"
diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml
index 645d2dc879..e169116e4a 100644
--- a/.github/workflows/update-flake-lock.yml
+++ b/.github/workflows/update-flake-lock.yml
@@ -15,21 +15,21 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v3.3.0
         with:
           client-id: ${{ secrets.UPDATE_APP_ID }}
           private-key: ${{ secrets.UPDATE_APP_PRIVATE_KEY }}
 
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v7.0.1
         with:
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Install Nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Update flake.lock and open PR
-        uses: DeterminateSystems/update-flake-lock@834c491b2ece4de0bbd00d85214bb5e83b4da5c6 # v28
+        uses: DeterminateSystems/update-flake-lock@v29
         with:
           token: ${{ steps.app-token.outputs.token }}
           commit-msg: "chore: update flake.lock (monthly)"